AI Governance, Risk, and Compliance
What you must know
AI governance is the set of policies, roles, and controls that keep an organization's AI use lawful, ethical, and aligned with business risk appetite. Candidates should be fluent in the distinction between governance (decision rights, accountability, policy) and compliance (evidence that external or internal obligations are met). Know the major frameworks by purpose, not memorized clause numbers: risk-management frameworks that treat AI risk as an extension of enterprise risk, and regulatory regimes that impose transparency, documentation, and human-oversight duties on high-risk uses.
Key concepts: risk tiering (classifying use cases by impact on people and safety), model and data inventories, accountability assignment (a named owner per model), human oversight for consequential decisions, documentation artifacts (model cards, data sheets, system cards), and third-party/vendor risk for foundation models and APIs. Understand bias and fairness testing, explainability obligations, and record retention for auditability.
Traps
- Confusing policy existence with control effectiveness; questions often reward the answer that produces evidence, not the answer that produces a document.
- Assuming a vendor's compliance certification transfers to your use case. It does not; you inherit obligations for how you deploy.
- Treating governance as a one-time approval. Continuous monitoring and re-review on material change are usually the correct answers.
- Picking "maximum restriction" answers; governance is proportional to risk tier.
Rule of thumb
If a question asks what to do first for a new AI use case, the answer is almost always classify and assign ownership before building controls.